Skip to content

Commit 50d00e1

Browse files
committed
tests: add unit tests for client certificate verification API
1 parent 0b8c1c0 commit 50d00e1

File tree

1 file changed

+163
-1
lines changed

1 file changed

+163
-1
lines changed

t/140-ssl-c-api.t

Lines changed: 163 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
1010
if ($openssl_version =~ m/built with OpenSSL (0|1\.0\.(?:0|1[^\d]|2[a-d]).*)/) {
1111
plan(skip_all => "too old OpenSSL, need 1.0.2e, was $1");
1212
} else {
13-
plan tests => repeat_each() * (blocks() * 5 + 1);
13+
plan tests => repeat_each() * 38;
1414
}
1515

1616
$ENV{TEST_NGINX_HTML_DIR} ||= html_dir();
@@ -61,6 +61,9 @@ ffi.cdef[[
6161
void ngx_stream_lua_ffi_free_priv_key(void *cdata);
6262
6363
int ngx_stream_lua_ffi_ssl_clear_certs(void *r, char **err);
64+
65+
int ngx_stream_lua_ffi_ssl_verify_client(void *r, int depth, void *cdata, char **err);
66+
6467
]]
6568
_EOC_
6669
}
@@ -675,3 +678,162 @@ lua ssl server name: "test.com"
675678
--- no_error_log
676679
[error]
677680
[alert]
681+
682+
683+
684+
=== TEST 6: verify client with CA certificates
685+
--- stream_config
686+
server {
687+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
688+
689+
ssl_certificate_by_lua_block {
690+
collectgarbage()
691+
692+
local ffi = require "ffi"
693+
require "defines"
694+
695+
local errmsg = ffi.new("char *[1]")
696+
697+
local r = require "resty.core.base" .get_request()
698+
if not r then
699+
ngx.log(ngx.ERR, "no request found")
700+
return
701+
end
702+
703+
local f = assert(io.open("t/cert/test.crt", "rb"))
704+
local cert_data = f:read("*all")
705+
f:close()
706+
707+
local cert = ffi.C.ngx_stream_lua_ffi_parse_pem_cert(cert_data, #cert_data, errmsg)
708+
if not cert then
709+
ngx.log(ngx.ERR, "failed to parse PEM cert: ",
710+
ffi.string(errmsg[0]))
711+
return
712+
end
713+
714+
local rc = ffi.C.ngx_stream_lua_ffi_ssl_verify_client(r, 1, cert, errmsg)
715+
if rc ~= 0 then
716+
ngx.log(ngx.ERR, "failed to set cdata cert: ",
717+
ffi.string(errmsg[0]))
718+
return
719+
end
720+
}
721+
722+
ssl_certificate ../../cert/test2.crt;
723+
ssl_certificate_key ../../cert/test2.key;
724+
725+
return "$ssl_client_verify\n";
726+
}
727+
--- stream_server_config
728+
lua_ssl_trusted_certificate ../../cert/test.crt;
729+
730+
proxy_pass unix:$TEST_NGINX_HTML_DIR/nginx.sock;
731+
proxy_ssl on;
732+
proxy_ssl_certificate ../../cert/test.crt;
733+
proxy_ssl_certificate_key ../../cert/test.key;
734+
735+
--- stream_response
736+
SUCCESS
737+
--- error_log
738+
739+
--- no_error_log
740+
[error]
741+
[alert]
742+
743+
744+
745+
=== TEST 7: verify client without CA certificates
746+
--- stream_config
747+
server {
748+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
749+
750+
ssl_certificate_by_lua_block {
751+
collectgarbage()
752+
753+
local ffi = require "ffi"
754+
require "defines"
755+
756+
local errmsg = ffi.new("char *[1]")
757+
758+
local r = require "resty.core.base" .get_request()
759+
if not r then
760+
ngx.log(ngx.ERR, "no request found")
761+
return
762+
end
763+
764+
local rc = ffi.C.ngx_stream_lua_ffi_ssl_verify_client(r, 1, nil, errmsg)
765+
if rc ~= 0 then
766+
ngx.log(ngx.ERR, "failed to set cdata cert: ",
767+
ffi.string(errmsg[0]))
768+
return
769+
end
770+
}
771+
772+
ssl_certificate ../../cert/test2.crt;
773+
ssl_certificate_key ../../cert/test2.key;
774+
775+
return "$ssl_client_verify\n";
776+
}
777+
--- stream_server_config
778+
lua_ssl_trusted_certificate ../../cert/test.crt;
779+
780+
proxy_pass unix:$TEST_NGINX_HTML_DIR/nginx.sock;
781+
proxy_ssl on;
782+
proxy_ssl_certificate ../../cert/test.crt;
783+
proxy_ssl_certificate_key ../../cert/test.key;
784+
785+
--- stream_response
786+
FAILED:self signed certificate
787+
--- error_log
788+
789+
--- no_error_log
790+
[error]
791+
[alert]
792+
793+
794+
795+
=== TEST 8: verify client but client provides no certificate
796+
--- stream_config
797+
server {
798+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
799+
800+
ssl_certificate_by_lua_block {
801+
collectgarbage()
802+
803+
local ffi = require "ffi"
804+
require "defines"
805+
806+
local errmsg = ffi.new("char *[1]")
807+
808+
local r = require "resty.core.base" .get_request()
809+
if not r then
810+
ngx.log(ngx.ERR, "no request found")
811+
return
812+
end
813+
814+
local rc = ffi.C.ngx_stream_lua_ffi_ssl_verify_client(r, 1, nil, errmsg)
815+
if rc ~= 0 then
816+
ngx.log(ngx.ERR, "failed to set cdata cert: ",
817+
ffi.string(errmsg[0]))
818+
return
819+
end
820+
}
821+
822+
ssl_certificate ../../cert/test2.crt;
823+
ssl_certificate_key ../../cert/test2.key;
824+
825+
return "$ssl_client_verify\n";
826+
}
827+
--- stream_server_config
828+
lua_ssl_trusted_certificate ../../cert/test.crt;
829+
830+
proxy_pass unix:$TEST_NGINX_HTML_DIR/nginx.sock;
831+
proxy_ssl on;
832+
833+
--- stream_response
834+
NONE
835+
--- error_log
836+
837+
--- no_error_log
838+
[error]
839+
[alert]

0 commit comments

Comments
 (0)